Cpe:2.3:a:semaphoreui:semaphore:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3asemaphoreuisemaphore/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 00:07:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSemaphore UI Cross-Site Request Forgery Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-09-semaphore-ui-csrf/Fri, 04 Sep 2026 00:07:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-semaphore-ui-csrf/Semaphore UI is vulnerable to a CSRF attack via the password change endpoint, enabling unauthenticated attackers to hijack user accounts, including administrator accounts, by inducing an authenticated user to visit a malicious webpage.Semaphore UI, an open-source automation platform, contains a critical Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-73292) identified in versions prior to 0.0.0-20260707190631-c59c3dc9035b. The vulnerability stems from the password change endpoint (/api/users/<id>/password) failing to enforce CSRF tokens or require re-authentication via a current password. Additionally, session cookies lack 'SameSite' attribute enforcement, facilitating cross-origin request abuse. By tricking an authenticated user into visiting a crafted malicious page, an attacker can silently execute a password change request. This allows for full account takeover, including the administrative account, depending on the targeted user's privileges. Defenders should prioritize patching, as this vulnerability requires minimal user interaction and leads to complete platform compromise.

Impact

Successful exploitation results in the takeover of the targeted user's account. Because this vulnerability allows an attacker to change the administrator's password, it can lead to full administrative compromise of the Semaphore UI instance, enabling an attacker to manipulate projects, run arbitrary automation tasks, and potentially escalate access within the organization's infrastructure.

Recommendation

  1. Upgrade Semaphore UI to the latest patched version (>= 0.0.0-20260707190631-c59c3dc9035b) immediately to remediate CVE-2026-73292.
  2. Implement global 'SameSite=Strict' or 'SameSite=Lax' cookie policies via load balancers or WAFs if immediate patching is not feasible.
  3. Review audit logs for suspicious password change events occurring from unexpected IP addresses or anomalous User-Agent strings.
]]>mediumadvisoryweb-vulnerabilitycsrfaccount-takeoverSemaphore UI Privilege Escalation via Custom Role Slug Collisionhttps://feed.craftedsignal.io/briefs/2026-09-semaphore-privilege-escalation/Fri, 04 Sep 2026 00:07:18 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-semaphore-privilege-escalation/Semaphore UI is vulnerable to a privilege escalation where a project manager can create a colliding custom role slug to assign themselves owner-level permissions, bypassing access controls.Semaphore UI, a web-based automation platform, contains a critical privilege escalation vulnerability (CVE-2026-73293) in its custom project role management feature. A project member assigned the 'manager' role can escalate their privileges to those of a project owner by exploiting a slug collision vulnerability during the custom role creation process. The application's ProjectMiddleware incorrectly resolves effective permissions by prioritizing database role rows that match a user's assigned role slug. Because the API route POST /api/project/{id}/roles does not reserve built-in slug names (such as 'manager' or 'owner') or enforce a permission ceiling, a manager can create a custom role with the slug 'manager' and set the permission bitmask to the value of an owner. This flaw allows a malicious project manager to gain administrative control over the project, including the ability to change project settings, modify other project members, or demote the legitimate project owner.

Attack Chain

  1. The attacker is assigned the built-in 'manager' role within a target project.
  2. The attacker authenticates to the Semaphore UI and confirms their current restricted permission state via GET /api/project/{id}/role.
  3. The attacker crafts a POST request to /api/project/{id}/roles containing a JSON payload with slug: "manager" and permissions: 15.
  4. The application processes the request, creating a new role row in the database with the colliding slug 'manager' and the elevated permission bitmask.
  5. On the next API request, the ProjectMiddleware executes GetProjectOrGlobalRoleBySlug, which fetches the attacker-created role row.
  6. The application overwrites the manager's effective permission bitmask with the elevated value from the database row.
  7. The attacker performs previously unauthorized actions, such as PUT /api/project/{id} to modify project settings or POST /api/project/{id}/users to alter member access levels.

Impact

Successful exploitation allows a project manager to effectively act as a project owner. This results in complete control over project resources, unauthorized access to sensitive project settings, the ability to remove or demote other users, and the potential for project deletion. This vulnerability affects instances utilizing the PRO build of Semaphore UI where custom project roles are active.

Recommendation

Update Semaphore UI to version 0.0.0-20260705182501-bb2a4e1f08c8 or later to resolve CVE-2026-73293. For current deployments, monitor web server logs for POST requests to /api/project/*/roles from users with the 'manager' role that attempt to define reserved slugs such as 'manager', 'owner', 'task_runner', or 'guest'.

]]>highadvisoryprivilege-escalationweb-applicationcve